client: prohibit unprivileged users from setting sgid/suid bits

Origin: https://github.com/ceph/ceph/commit/7028ed21138522495df1e9f8b01195a3c43d47ff

Prior to fb1b72d, unprivileged users could add mode bits as long as
S_ISUID and S_ISGID were not included in the change.

After fb1b72d, unprivileged users were allowed to modify S_ISUID and
S_ISGID bits only when no other mode bits were changed in the same
operation. This inadvertently permitted unprivileged users to set
S_ISUID and/or S_ISGID bits when they were the sole bits being modified.

This behavior should not be allowed. Unprivileged users should be
prohibited from setting S_ISUID and/or S_ISGID bits under any
circumstances.

This change tightens the permission check to prevent unprivileged
users from setting these privileged bits in all cases.

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
Gbp-Pq: Name client-prohibit-unprivileged-users-from-setting-sgid.patch

client: disallow unprivileged users to escalate root privileges

Origin: https://github.com/ceph/ceph/commit/b6d85b595ea7c9e0fca10d5e77a48102110fe22c
Bug-Debian: https://bugs.debian.org/1108410
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-52555

An unprivileged user can `chmod 777` a directory owned by root
and gain access. Fix this bug and also add a test case for the
same.

Signed-off-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Venky Shankar <vshankar@redhat.com>
Gbp-Pq: Name client-disallow-unprivileged-users-to-escalate-root-.patch

Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty

Origin: https://github.com/ceph/ceph/commit/bef59f17293e6e93af025eba1e00646d0b1a2bf0
Bug-Debian: https://bugs.debian.org/1120797
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-47866

The issue was that the `HTTP_X_AMZ_COPY_SOURCE` header could be present but empty (i.e., an empty string rather than NULL). The  code only checked if the pointer was not NULL, but didn't verify that the string had content. When an empty string was passed to RGWCopyObj::parse_copy_location(), it would eventually try to access name_str[0] on an empty string, causing a crash.

Fixes: https://tracker.ceph.com/issues/72669
Signed-off-by: Suyash Dongre <suyashd999@gmail.com>
Gbp-Pq: Name Check-if-HTTP_X_AMZ_COPY_SOURCE-header-is-empty.patch

mgr/alerts: enforce ssl context to SMTP_SSL

Origin: https://github.com/ceph/ceph/commit/5081933c9a0068fe9deba4fca2d943bda3168518
Bug-Debian: https://bugs.debian.org/1126573
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-31884

Fixes: https://github.com/ceph/ceph/security/advisories/GHSA-xj9f-7g59-m4jx
Signed-off-by: Nizamudeen A <nia@redhat.com>
(cherry picked from commit 5f7fc5267e55089eeb1cfc87e9c1215c32439102)

Gbp-Pq: Name mgr-alerts-enforce-ssl-context-to-SMTP_SSL.patch

[PATCH] [CVE-2024-48916] rgw/sts: fix to disallow unsupported JWT algorithms while authenticating AssumeRoleWithWebIdentity using JWT obtained from an external IDP.

fixes: https://tracker.ceph.com/issues/68836

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
Gbp-Pq: Name CVE-2024-48916.patch

CVE-2022-3854: rgw: Guard against malformed bucket URLs

Fixes: https://tracker.ceph.com/issues/55765
Fixes: https://tracker.ceph.com/issues/56586
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Origin: upstream, https://github.com/ceph/ceph/pull/47194/commits/9746e8011ff1de6de7dba9c0041e28a16c8f6828.patch
Bug-Debian: https://bugs.debian.org/1027151
Last-Update: 2022-01-09

Misplaced colons can result in radosgw thinking is has a bucket URL
but with no bucket name, leading to a crash later on.

Gbp-Pq: Name CVE-2022-3854_1_rgw_Guard_against_malformed_bucket_URLs.patch

Fix CheckCxxAtomic to detect more accurately

Last-Update: 2022-08-30

Some platforms like riscv64 does not have full support for atomic primitives,
yet passes the test. Adding operator++ fixes this issue.

Gbp-Pq: Name fix-CheckCxxAtomic-riscv64.patch

Fix build with fmt 8/9

+ changes in segment_manager.cc and segment_manager.h are backported from
  part of the large changes in https://github.com/ceph/ceph/commit/d5b0cd13
+ change in node_extent_accessor.h is not forwarded to upstream since it's
  a workaround. However it doesn't harm since it's just a error message
  which shouldn't happen anyway.
+ changes in seastar is backported from
  https://github.com/scylladb/seastar/commit/dfb62861
+ changes in crimson/osd/main.cc is backported from
  https://github.com/ceph/ceph/commit/58cb9bac

Gbp-Pq: Name Fix-build-with-fmt-8-9.patch

Only yield under ARMv7 and above (#1176)

Origin: upstream, https://github.com/facebook/folly/commit/62d8e6e0b91ebd6f878f3066cd9b6e5f3c18a97b.patch
Last-Update: 2021-11-24

Gbp-Pq: Name only-yied-under-armv7-and-above.patch

cmake: test for 16-byte atomic support on mips also

Origin: upstream, https://github.com/ceph/ceph/commit/709a77f22010f03aee4a4c0ab930588944cb4a58
Last-Update: 2021-11-24

it's reported that a mips64el build host is able to pass the test of
CheckCxxAtomic without linking against libatomic, while librbd.so
fails to link due to failures like

/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_store_16'
/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_load_16'
/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_compare_exchange_16'

so we have to check the existence of __atomic_load_16 instruction on
mips architecture.

Gbp-Pq: Name cmake-test-for-16-bytes-atomic-support-on-mips-also.patch

[PATCH] rgw/radosgw-admin clarify error when email address already in use

The error message if you try and create an S3 user with an email
address that is already associated with another S3 account is very
confusing; this patch makes it much clearer

To reproduce:

radosgw-admin user create --uid=foo --display-name="Foo test" --email=bar@domain.invalid
radosgw-admin user create --uid=test --display-name="AN test" --email=bar@domain.invalid
could not create user: unable to parse parameters, user id mismatch, operation id: foo does not match: test

With this patch:

radosgw-admin user create --uid=test --display-name="AN test" --email=bar@domain.invalid
could not create user: unable to create user test because user id foo already exists with email bar@domain.invalid

Fixes: https://tracker.ceph.com/issues/49137
Fixes: https://tracker.ceph.com/issues/19411
Signed-off-by: Matthew Vernon <mv3@sanger.ac.uk>
(cherry picked from commit 05318d6f71e45a42a46518a0ef17047dfab83990)

Gbp-Pq: Name bug1914584.patch

[PATCH] arch,cmake: compile ppc.c on all powerpc machines

* cmake/modules/SIMDExt.cmake: define HAVE_PPC for 32-bit PowerPC.
* src/arch/CMakeLists.txt: compile ppc.c for all PowerPC architectures,
  including powerpc (32-bit PowerPC), ppc64el (64-bit Little Endian
  PowerPC) and ppc64 (64-bit Big Endian PowerPC).

before this change, ppc.c is only compiled if HAVE_POWER8 is defined.
but Power8 is a 64-bit PowerPC architecture. while in src/arch/probe.cc,
we check for `defined(__powerpc__) || defined(__ppc__)`, if this is
true, ceph_arch_ppc_probe() is used to check for the support of
Altivec. but on non-power8 PowerPC machines, the linker fails to find the
symbols like ceph_arch_ppc_probe(), as ppc.c is not compiled on them.

in this change, ppc.c is compiled on all PowerPC architectures, so that
ceph_arch_ppc_probe() is also available on non-power8 machines. this
change does not impact the behavior of non-power8 machines. because
on them, the runtime check would fail to detect the existence of
PPC_FEATURE2_VEC_CRYPTO instructions.

Reported-by: Mattias Ellert <mattias.ellert@physics.uu.se>
Signed-off-by: Kefu Chai <tchaikov@gmail.com>
Gbp-Pq: Name compile-ppc.c-on-all-powerpc-machines.patch

Fix systemd ceph-osd.target

Forwarded: no
Last-Update: 2021-01-28

This helps when rebooting.

Gbp-Pq: Name fix-ceph-osd-systemd-target.patch

Link with -pthread instead of -lpthread to fix FTBFS on riscv64

Forwarded: no
Last-Update: 2020-03-01

Gbp-Pq: Name riscv64-link-pthread.patch

add-option-to-disable-ceph-dencoder

===================================================================

Gbp-Pq: Name add-option-to-disable-ceph-dencoder.patch

Misc fixes for 32 bit architecture builds.

Forwarded: no

Gbp-Pq: Name 32bit-fixes.patch

fix-bash-completion-location

Gbp-Pq: Name fix-bash-completion-location

debian-armel-armhf-buildflags

Gbp-Pq: Name debian-armel-armhf-buildflags.patch

Adds max_connections to test display.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/3b8eb36676f70d06f8918ccf62029207c49cdda0
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable_test.patch

Makes SOMAXCONN user-configurable.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/febab7dc38c9671577603425c54c20f841e27f97
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable.patch

Adds max_connections to reference configuration.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/3b8eb36676f70d06f8918ccf62029207c49cdda0
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable_conf.patch

disable-crypto

===================================================================

Gbp-Pq: Name disable-crypto.patch

use --release 7 instead of -source/-target

Bug-Ubuntu: https://launchpad.net/bugs/1756854
Bug-Ubuntu: https://launchpad.net/bugs/1766998
Forwarded: no
Last-Update: 2018-04-24

Instead of -source/-target ceph should be build with --release for OpenJDK 9
or later so that the bootclasspath is also set, as per JEP-247, otherwise it
risks incurring into binary incompatibility when run with an earlier OpenJDK.
OpenJDK 11 minimum compatibility release has been updated to 7.
Last-Update: 2018-04-24
Gbp-Pq: Name update-java-source-target-flags.patch

This defines HAVE_REENTRANT_STRSIGNAL as sys_siglist no longer

Forwarded: no
Last-Update: 2020-09-21

 exists with glibc 2.32 and all programs should use strsignal instead.

Gbp-Pq: Name enable-strsignal.patch

ceph (16.2.15+ds-0+deb12u2) bookworm-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * mgr/alerts: enforce ssl context to SMTP_SSL (CVE-2024-31884)
    (Closes: #1126573)
  * Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty (CVE-2024-47866)
    (Closes: #1120797)
  * client: disallow unprivileged users to escalate root privileges
    (CVE-2025-52555) (Closes: #1108410)
  * client: prohibit unprivileged users from setting sgid/suid bits

[dgit import unpatched ceph 16.2.15+ds-0+deb12u2]

Import ceph_16.2.15+ds-0+deb12u2.debian.tar.xz

[dgit import tarball ceph 16.2.15+ds-0+deb12u2 ceph_16.2.15+ds-0+deb12u2.debian.tar.xz]

Import ceph_16.2.15+ds.orig.tar.xz

[dgit import orig ceph_16.2.15+ds.orig.tar.xz]